topic Re: Check event count before running stats? in Splunk Search

Check event count before running stats?

exocore123 — Tue, 13 Apr 2021 18:11:55 GMT

I have a query where it runs a certain summary query every 15 minutes in a bucket. However, there are fairly frequent maintenance that happens for our splunk dev team which causes a lot of missing time frames in the query and causes our alerts to misfire.

Currently:

index=summary-ecp-ord-oms source=ecp-ord-owls-transaction-perf-15min earliest=-10080m latest=-10070m | stats sum(count) as previous by request

I was wondering if there is something like a way to check if the results from the initial query is more than 3, then run the stats on the data. Otherwise, return nothing.

index=summary-ecp-ord-oms source=ecp-ord-owls-transaction-perf-15min earliest=-10080m latest=-10070m | where eventcount > 3 | stats sum(count) as previous by request

Re: Check event count before running stats?

ITWhisperer — Tue, 13 Apr 2021 19:18:38 GMT

index=summary-ecp-ord-oms source=ecp-ord-owls-transaction-perf-15min earliest=-10080m latest=-10070m | eventstats count as eventcount | where eventcount > 3 | stats sum(count) as previous by request

Re: Check event count before running stats?

exocore123 — Tue, 13 Apr 2021 19:51:44 GMT

Ooof, I was so close to the answer. Thank you. Didnt realize I was writing eventstat wrong